Glog · Glog · CVE-2024-45339
**Name of the Vulnerable Software and Affected Versions**
glog (affected versions not specified)
**Description**
The issue arises when logs are written to a widely-writable directory, allowing an unprivileged attacker to predict a privileged process's log file path and create a symbolic link to a sensitive file in its place. When the privileged process runs, it follows the planted symlink and overwrites the sensitive file. To address this, glog now exits the program with a status code of 2 when it discovers that the configured log file already exists.
**Recommendations**
To resolve the issue, ensure that glog is configured to write logs to a directory that is not widely writable.
As a temporary workaround, consider restricting write access to the log directory to prevent unprivileged attackers from creating symbolic links to sensitive files.
Avoid using widely-writable directories for logging until the issue is fully addressed.